skills/xiaomi/hiui/ux-walkthrough/Gen Agent Trust Hub

ux-walkthrough

Pass

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to orchestrate its internal Python scripts (e.g., precheck_walkthrough.py calling detect_input_mode.py and scan-pages.py). This is a standard orchestration pattern for multi-script tools.
  • [COMMAND_EXECUTION]: The skill is designed to identify and optionally execute dev server commands (e.g., npm run dev) found in the user-provided project's package.json to enable URL-based walkthroughs on local development environments.
  • [DATA_EXPOSURE]: The skill scans the local file system within a directory provided by the user to identify frontend project structures, routing, and components. This access is necessary for its core functionality and is restricted to the input path.
  • [EXTERNAL_DOWNLOADS]: The skill's requirements.txt specifies standard, well-known dependencies including python-docx, Pillow, and ocrmac. No unauthorized or suspicious remote code downloads were detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 20, 2026, 02:44 AM
Security Audit — agent-trust-hub — ux-walkthrough